https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33576#M643 <P>I would like to know how to create a Firewall Deny Report that looks like this.<BR /><BR /> <IMG src="http://i.imgur.com/j1yOb.jpg" alt="alt text" /></P> Mon, 23 Apr 2012 20:04:21 GMT jraquino 2012-04-23T20:04:21Z https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33576#M643 <P>I would like to know how to create a Firewall Deny Report that looks like this.<BR /><BR /> <IMG src="http://i.imgur.com/j1yOb.jpg" alt="alt text" /></P> Mon, 23 Apr 2012 20:04:21 GMT https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33576#M643 jraquino 2012-04-23T20:04:21Z https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33577#M644 <P>Hey JR- one way to do that is to do a statistical count of destination ports and destination IPs that have been denied, then chart a sum by the destination ports and destination IPs as they apply.<BR /> sourcetype="firewall" action=deny | stats count by dst dst_port | chart sum(count) by dst dst_port. the fields will depend on your extracted fields, but give that a shot, it should do the trick.</P> Mon, 28 Sep 2020 11:42:36 GMT https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33577#M644 fwilmot 2020-09-28T11:42:36Z https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33578#M645 <P>Any idea on how to use the output of that report but limit the number of IP's to say 5-10 and list them along the bottom?</P> Fri, 30 May 2014 00:05:54 GMT https://community.splunk.com/t5/Reporting/How-do-I-create-a-Firewall-Report-with-Both-Destination-IP-and/m-p/33578#M645 lbogle 2014-05-30T00:05:54Z